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Abstract. We provide new upper bounds on Nq{g), the maximum number 
of rational points on a smooth absolutely irreducible genus-g curve over Fq, 
for many values of q and g. Among other results, we find that Ni{7) = 21 and 
Ns{5) = 29, and we show that a genus-12 curve over F2 having 15 rational 
points must have characteristic polynomial of Frobenius equal to one of three 
explicitly given possibilities. 

We also provide sharp upper bounds for the lengths of the shortest vectors 
in Hermitian lattices of small rank and determinant over the maximal orders 
of small imaginary quadratic fields of class number 1. 

Some of our intermediate results can be interpreted in terms of Mordell— 
Weil lattices of constant elliptic curves over one-dimensional function fields 
over finite fields. Using the Birch and Swinnerton-Dyer conjecture for such 
elliptic curves, we deduce lower bounds on the orders of certain Shafarevich— 
Tate groups. 



1. Introduction 

The last three decades have seen increasing interest in the calculation of the 
value of Nq{g), the maximum number of rational points on a smooth, absolutely 
irreducible curve C of genus g over a finite field F^. Initially this increased interest 
was motivated in part by new constructions of error-correcting codes exceeding the 
Gilbert-Varshamov bound, but now there are many problems related to the compu- 
tation of Nq{g) that are mathematically attractive in their own right, independent 
of possible applications in coding theory. 

In the 1940s, Andre Weil |46fl49] showed that if C is a genus-g curve over Fq, 
then 

q + l- 2gV? < #C{Fq) <q + l + 2g^, 

so that Nq{g) < q + 1 + 2g^. In the 1980s this upper bound was improved in a 
number of ways. Serre |35j showed that 

Nq{g) <q + l + g[2^\, 

and Manin and Ihara [TB] showed that the Weil bound could be improved even 
further when g is large with respect to q. Generalizing these ideas, Drinfel'd and 
Vladu^ showed that for fixed q, 

Ng{g) < - 1 + o{l))g as5-^cx), 



Date: 28 February 2012. 

2010 Mathematics Subject Classification. Primary 11G20; Secondary 14G05, 14G10, 14G15. 
Key words and phrases. Curve, rational point, zeta function, Weil bound, Serre bound, 
Oesterle bound, Birch and Swinnerton-Dyer conjecture. 

1 



2 



HOWE AND LAUTER 



and Serre [38] developed the "explicit formulae" method (optimized by Oesterle), 
which gives the best bound on Nq{g) that can be obtained formally using only 
Weil's "Riemann hypothesis" for curves and the fact that for every d > the 
number of degree-d places on a curve is non-negative. For general q and g the 
Oesterle bound has not been improved upon, but for certain families and special 
cases improvements can be made [SlITSlIIllllTlIIllEOHSlllMlESSHlllTl^ 

In 2000, van der Geer and van der Vlugt [8] published a table of the best upper 
and lower bounds on Nq{g) known at the time, for g < 50 and for q ranging 
over small powers of 2 and 3. They updated their paper twice a year after its 
publication, and the revised versions were made available on van der Geer's website. 
In 2010, van der Geer, Ritzenthaler, and the authors, with technical assistance from 
Geerit Oomens, incorporated the updated tables from [8 into the online tables now 
available at manypoints.org. These new online tables display results for many 
more prime powers q than were in [5]: the primes less than 100, the prime powers 

for p < 20 and i < 5, and the powers of 2 up to 2^. The original tables of 
van der Geer and van der Vlugt inspired us to do the work that appeared in our 
earlier paper |14j : afterwards, we continued to work on the problem of improving 
the known upper bounds on Nq{g), and the work we present in this paper was used 
to help populate the manypoints tables when the site was created. 

In our 2003 paper we used a number of techniques to show that certain isogeny 
classes of abelian varieties over finite fields do not contain Jacobians of curves; by 
enumerating the isogeny classes of a given dimension g over a given field Fq that 
could possibly contain a Jacobian of a curve with N points, and then applying 
our techniques, we were able to show that some values of N could not occur. We 
were thus able to improve the known upper bounds on Nq{g) for many pairs {q,g). 
In this paper, we introduce four new techniques that can sometimes be used to 
show that an isogeny class of abelian varieties does not contain a Jacobian. These 
new techniques were responsible for improving more than 16% of the upper bounds 
in the 2009 version of [8] when those results were integrated into the manypoints 
tables. 

The first of our new techniques concerns isogeny classes containing product va- 
rieties. In our earlier paper, we showed that one can sometimes deduce arithmetic 
and geometric properties of curves whose Jacobians are isogenous to a product 
A X B when the resultant of the radicals of the "real Weil polynomials" (see Sec- 
tion [5]) of A and B is small. The first improvement we introduce here is to show 
that we can replace the resultant by the reduced resultant in these arguments. The 
reduced resultant is defined, and the new results are explained, in Section [2] We 
also explain how in certain circumstances we can replace the reduced resultant by 
an even smaller quantity that depends more delicately on the varieties A and B. 

In our earlier paper, we showed that if i? is a supersingular elliptic curve over 
Fq with all endomorphisms defined over Fq, and if A is an ordinary elliptic curve 
such that the resultant of the real Weil polynomials of E and A is squarefree, then 
there is no Jacobian isogenous to x A for any ti > 0. Our second improvement 
is to show that the same statement holds when A is an arbitrary ordinary variety. 
This is explained in Section [3l 

Our third new technique concerns isogeny classes that contain a variety of the 
form A X i?", where E is an ordinary elliptic curve over Fq. We show in Section [4] 
that if a curve C has Jacobian isogenous to A x E"-, then there is a map from C 
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to E whose degree is bounded above by an explicit function of the discriminant 
of End_E, the reduced resultant of the real Weil polynomials of E and A, and the 
exponent n. In order to produce the sharpest bounds possible, we give an algorithm 
for computing the length of the shortest nonzero vectors in small Hermitian lattices 
over imaginary quadratic fields of class number 1. We provide tables of some of 
these sharp upper bounds in Section |4l 

Our fourth technique is a theorem that gives an easy-to-check necessary and 
sufficient condition for the entire category of abelian varieties in a given ordinary 
isogeny class over a finite field to be definable over a subfield. We present this result 
and explain its significance in Section [5] 

We have implemented all of our calculations in the computer algebra package 
Magma [5. The programs we use are found in the package IsogenyClasses .magma, 
which is available on the first author's website: Go to the bibliography page 

http : //alumni . caltech.edu/ -however/biblio .html 
and follow the link associated to this paper. We outline the structure of these 
Magma routines in Section [6l and in Section [7] we present a sampling of the com- 
putational results we have obtained. These include two new values of Ng{g) and an 
analysis of the possible Weil polynomials of genus- 12 curves over F2 meeting the 
Oesterle bound. 

As we have mentioned, some of our arguments give upper bounds for the degrees 
of maps from a curve C to an elliptic curve E. Such upper bounds give restrictions 
on the determinant of the Mordell-Weil lattice of the base extension of E to the 
function field K of C. In Section [8] we indicate how some of our results, when 
combined with proven cases of the conjecture of Birch and Swinnerton-Dyer, allow 
us to give lower bounds (and sometimes even exact formulas) for the size of the 
Shafarevich-Tate group of E over K. 

2. Reduced resultants and the gluing exponent 

In our previous paper |14j we analyzed non-simple isogeny classes of abelian vari- 
eties over finite fields by bounding the 'distance' between a variety A in the isogeny 
class and a product variety, measured essentially by the degree of the smallest 
isogeny from A to a product. We continue to use this same strategy, but we will 
improve upon our earlier bounds. 

In the following definition, we use the convention that the greatest common 
divisor of the set {0} is 00. 

Definition 2.1. Let Ai and A2 be abelian varieties over a finite field k. Let E 
be the set of integers e with the following property: If A is a finite group scheme 
over k that can be embedded in a variety isogenous to Ai and in a variety isogenous 
to A2, then eA = 0. We define the gluing exponent e(yli, A2) of Ai and A2 to be 
the greatest common divisor of the set E. 

If Ai and A2 have no isogeny factor in common, there exist nonzero integers 
e with the property mentioned in the definition — for example, the proof of |14[ 
Lem. 7, p. 1684] shows that the quantity s(j4i, A2) defined in [TU §1] has the desired 
property — so e(Ai,^2) is finite in this case. Clearly 6(^1,^2) depends only on 
the isogeny classes of Ai and A2. 

We make this definition because many of the results in jl4] remain true if their 
statements are modified by replacing s{Ai,A2) with e{Ai,A2)\ this is so because 
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the only property of s{Ai,A2) used in the proofs of these results is that it lies in 
the set E. In particular, [TH Thm. 1, p. 1678] becomes the following. 

Theorem 2.2. Let Ai and A2 he nonzero abelian varieties over a finite field k. 

(a) Ife(Ai, A2) — 1 then there is no curve C over k whose Jacobian is isogenous 
to Ai X ^2- 

(b) Suppose e(v4i, A2) ~ 2. If C is a curve over k whose Jacobian is isogenous 
to Ai y. A2, then there is a degree-2 map from C to another curve D over 
k whose Jacobian is isogenous to either Ai or A2. □ 

Also, [131 Lem. 7, p. 1684] becomes: 

Lemma 2.3. Suppose B is an abelian variety over a finite field k isogenous to a 
product Ai X A2, where 6(^1,^2) < 00. Then there exist abelian varieties A'^ and 
A'2, isogenous to Ai and A2, respectively, and an exact sequence 

^ A ^ a; X ^ S ^ 

such that the projection maps A'^ x — >■ A'l and A[ x A'2 ^ A'2 give monomorphisms 
from A to A'^[e] and to A'2[e], where e = 6(^1,^2). 

Suppose in addition that B has a principal polarization /i. Then the pullback of 11 
to A-y X A'2 is a product polarization Ai x A2, and the projection maps A'-^ x A'2 ^ A'-^ 
and A'-^ x A'2 ^ A'2 give isomorphisms of A with ker Ai and ker A2. In particular, 
A is isomorphic to its own Cartier dual. □ 

Furthermore, [HI Prop. 11, p. 1688] becomes: 

Proposition 2.4. Let Ai and A2 be abelian varieties over a finite field k, and let 
e = 6(^1,^2)- Suppose that e < 00 and that for every A!^ isogenous to A\ and every 
A'2 isogenous to A2, the only self-dual finite group-scheme that can be embedded in 
both A'i[e\ and A'2[e\ as the kernel of a polarization is the trivial group-scheme. 
Then there is no curve over k with Jacobian isogenous to Ai x A2. □ 

And finally, [14, Prop. 13, p. 1689] becomes: 

Proposition 2.5. Suppose C is a curve over a finite field k whose Jacobian is 
isogenous to the product A x E of an abelian variety A with an elliptic curve E, 
where e{A, E) < 00. Then there is an elliptic curve E' isogenous to E for which 
there is map from C to E' of degree dividing e{A, E), and we have =ffC{k) < e{A, E)- 
*E{k). □ 

These results will only be more useful than their predecessors from |14) if we can 
produce bounds on 6(^1,^2) that are better than the bound 6(^1,^2) | s(Ai,A2) 
that follows from the proof of [111 Lem. 7, p. 1684]. The main result of this section. 
Proposition 12.81 below, provides such improved bounds. To state the proposition, 
we must introduce the idea of the reduced resultant of two polynomials, together 
with a result about its computation. 

Definition 2.6 (Pohst (32i p. 179]). The reduced resultant of two polynomials f 
and g in Z[a;] is the non-negative generator of the ideal Z n (/, g) ofZ, where (/, g) 
is the ideal of 7i[x] generated by f and g. 

Alternatively (but equivalently) , one can define the reduced resultant of / and 
g to be the characteristic of the quotient ring Z[x]/ (/, g). The reduced resultant of 
/ and g is if and only if / and g are both divisible by a nonconstant polynomial; 
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also, the reduced resultant divides the usual resultant, and is divisible by all of the 
prime divisors of the usual resultant. 

Computing reduced resultants of monic elements of Z[a:] is straightforward, as 
the following lemma shows. 

Lemma 2.7. Let fi and /2 be coprime elements ofZ[x], not both constant, whose 
leading coefficients are coprime to one another, and let n be the reduced resultant 
of fi and /2 . 

(1) There are unique polynomials bi and 62 iri Z[a;] such that 

• deg bi < deg /2 

• deg 62 < deg /i 

• n = 61/1 + 62/2- 

(2) Let ai and a2 be the unique elements o/Q[x] such that 

• degai < deg/2 

• deg 02 < deg /i 

• 1 = ai/i + a2/2. 

Then the reduced resultant n of fi and f^ is the least common multiple of 
the denominators of the coefficients of ai and a2, and the polynomials bi 
and 62 from statement (1) satisfy bi = nai and 62 = na2. 

Proof. First we prove that there exist polynomials 61 and 62 with the properties 
listed in statement (1). The unicity of these polynomials will follow from state- 
ment (2). 

Let 61 and 62 be arbitrary elements of Z[x] such that n — 61/1 + 62/2- We 
will show that if deg 61 > deg/2 or deg 62 > deg/i then there are elements 61 
and 62 of Z[x], whose degrees are smaller than those of bi and 62, such that n = 
+&2/2- By successively replacing the 6's with the 5's, we will find a pair (61, 62) 
of polynomials that satisfy the conditions in statement (1). 

Let di and d2 be the degrees of 61 and 62- Since fei/i + 62/2 bas degree 0, we see 
that 

di + deg /i = d2 + deg /2, 
so that di > deg/2 if and only if d2 > deg/i. For each i let Ui be the leading 
coefRcient of bi and let Vi be the leading coefficient of fi. Then we must have 
uiVi + U2V2 = 0, and since vi and V2 are coprime to one another, vi divides U2 and 
V2 divides ui. If we set 

'bi = bi-{m/v2)x'''-''-shf^ 

"^2 = &2-(u2M)a;'*^-^^^^Vi 

then bi and 62 have the desired properties. 

Let ai and 02 be as in statement (2). The unicity of the a's shows that we 
must have 61 = nai and 62 = na2, and it follows that n is a multiple of all of the 
denominators of the coefficients of Oi and 02 . 

On the other hand, if m is the least common multiple of the denominators 
of Oi and 02, then max and 77102 are elements of Z[x], and the equality 777 = 
{mai)fi + {ma2)f2 shows that 777 is a multiple of n. Therefore n — m, and the 
lemma is proved. □ 

We are almost ready to state Proposition 12.81 Recall that the Weil polynomial 
of a d-dimensional abelian variety A over a finite field Fq is the characteristic poly- 
nomial / of the Frobenius endomorphism of A, and that the real Weil polynomial 
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of A is the unique polynomial h e Z[x] such that f{x) — x'^h{x + q/x). Recall also 
that the radical of a polynomial is the product of its irreducible factors, each taken 
once. The radical of the real Weil polynomial of an abelian variety over a finite 
field is the minimal polynomial of the endomorphism F + where F is Frobenius 
and V is Verschiebung. 

Proposition 2.8. Let Ai and A2 be nonzero abelian varieties over a finite field 
k with no isogeny factor in common. Let gi and 52 be the radicals of their real 
Weil polynomials, let n be the reduced resultant of gi and 52 , (ind let hi and 62 
he the unique elements of Z[a;] such that n = higi + 62^2 o-nd deg &i < deg(72 o,nd 
deg62 < deg 51. 

(1) The gluing exponent 6(^1,^2) divides n. 

(2) Let g — gig2, and suppose that g is divisible by x^ — 4q, where q = fj^k. If 
the coefficients of the polynomial bigi + xg/{x'^ — Aq) are all even, then n 
is even, and e{Ai,A2) divides n/2. 

We prove Proposition 12 .81 at the end of this section, after we state and prove two 
lemmas. Throughout the rest of this section, Ai and A2 will be abelian varieties 
as in the statement of the proposition, and F and V will be the Frobenius and 
Verschiebung endomorphisms of Ai x A2. 

Our first lemma shows that we can find bounds on e(j4i, A2) by understanding 
the endomorphism ring of Ai x A2. 

Lemma 2.9. For each i let ipi be the projection map End(Ai x A2) — > End A,;. 
Suppose /3 is an element of the subring Z[i^, V] of the center o/End(yli x A2) with 
the property that <pi(/3) — and (p2il3) is an integer n. Then the gluing exponent 
e{Ai,A2) is a divisor of n. 

Proof. Suppose A'l and A'2 are abelian varieties over k that are isogenous to Ai 
and A2, respectively. Note that F and V are endomorphisms of A'^ x A^, and that 
every isogeny from A'^ x A^ to Ai x A2 respects the actions of F and V . Therefore /3 
can be viewed as an endomorphism of A'^ x A'2, and the projections of (5 to End A'j^ 
and to EndA2 are and n, respectively. 

Suppose A is a finite group scheme over k for which there are monomorphisms 
A ^ A'^ and A for some A'^ and A'2 isogenous to Ai and A2. Frobenius and 

Verschiebung also act on A, and the existence of a monomorphism from A to A'^ 
shows that /3 acts as on A. But the existence of a monomorphism from A to A'2 
shows that /3 acts as n on A. Therefore A is killed by n, and e{Ai,A2) is a divisor 
of n. □ 

Lemma 2.10. Let a he an element of the subring Z[i^, V^] 0/ End(y4i x A2) and 
let gi and g2 he the minimal polynomials of a restricted to Ai and A2, respectively. 
Then the gluing exponent e{Ai , A2) is a divisor of the reduced resultant of gi and 52 ■ 

Proof. Let n be the reduced resultant of gi and g2, so that there are elements hi 
and 62 of l^x] such that n — 61.91+6252- Let P — {higi){a). Then /3 acts as on Ai, 
because it is a multiple of 51(a), and it acts as n on A2, because n — /3 = (6252) (a) 
is a multiple of g2{o)- It follows from Lemma [221 that e{Ai, A2) divides n. □ 

Proof of Proposition 12.81 Statement (1) follows from Lemma r2.10l and the fact that 
gi and 52 are the minimal polynomials of F-\-V restricted to Ai and A2, respectively. 
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Suppose g is divisible by — Aq, say g — (a;^ — 4g)/i. Let S be the subring 
Z[F, V] of the center of End(Ai x A2), and let R be the subring Z[F + V] of 5". The 
tensor product Rq = i? (g) Q is a product of fields Ki , with each Ki corresponding 
to an irreducible factor of g, and the tensor product Sq = Q is a product of 
fields Li, with each Li being an extension of Ki, of degree 1 if the corresponding 
factor of g divides — Aq, and of degree 2 otherwise. Let K be the product of the 
Ki corresponding to factors of g that do not divide — Aq, let K' be the product 
of the remaining Ki, and let L and L' be the products of the corresponding Li. 
Note that on each factor Li of L' we have F = V. 

Suppose the coefhcients of the polynomials r — bigi + xh are all even. Consider 
the polynomial in Z[u,t)] obtained by evaluating r aXu + v. Its coefficients are also 
all even, so the same is true of the polynomial 

bi{u + v)gi{u + v) + [u — v)h{u + v). 

Let s be 1/2 times this polynomial, so that s lies in Z[u, v], and s{F, V) lies in 5'. 

Consider the element {F — V)h{F + V) of 5'q. On each factor Li of L, this 
element is 0, because h{F + V) = on each factor Ki of K. But on each factor Li 
of L', we have F -V = 0. Thus, {F - V)h{F + V)=0. 

We see that 2s{F, V) differs from 61 (F + V)gi{F + V) by 0, so 2s{F, V) is equal 
to in End and is equal to n in Endv42. Since s{F, V) lies in End(^i x A2), it 
follows that n is even, and from Lemma [2?9l we see that the gluing exponent of Ai 
and A2 divides n/2. □ 

3. SUPERSINGULAR FACTORS IN THE JACOBIAN 

We say that a Weil polynomial or a real Weil polynomial is ordinary if the 
corresponding isogeny class consists of ordinary abelian varieties. In this section 
we will prove the following theorem, which generalizes [TU Cor. 12, p. 1689]. 

Theorem 3.1. Suppose h g Z[a;] is the real Weil polynomial oj an isogeny class of 
abelian varieties over a finite field k, where q — is a square. Suppose further 
that h can be written h ~ [x — 2s)"/io, where s^ — q, where n > 0, and where 
ho is a nonconstant ordinary real Weil polynomial such that the integer ho{2s) is 
squarefree. Then there is no curve over k with real Weil polynomial equal to h. 

The heart of the proof is a lemma about finite group schemes over finite fields. 

Lemma 3.2. Suppose A is a finite £-torsion group scheme over a finite field k with 
#A > £, and suppose the Frobenius and Verschiebung endomorphisms of A act as 
multiplication by an integer s with s^ — q. If A can be embedded in an ordinary 
abelian variety A over k with real Weil polynomial ho, then the integer /io(2s) is 
divisible by . 

Proof. First we prove the lemma under the additional assumption that A is simple. 

Let R be the subring Z[F, of End A, where F and V are the Frobenius and 
Verschiebung endomorphisms. Since A is ordinary and simple, the ring R is an 
order in a CM-field K whose degree over Q is twice the dimension d of A. If we 
define R~^ to be the subring Z[F + V] of R, then is an order in the maximal 
real subfield K'^ of K. (These facts follow, for instance, from the Honda- Tate 
theorem [43l Theoreme 1, p. 96].) It is easy to see that the elements 

1, F, V, F^, V^, V^-^, F'^ 
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form a basis for i? as a Z-module. 

Let p be the ideal {£,F — s,V — s) of R. We will show that p is a prime ideal, 
and that if /io(2s) is not divisible by l'^ then the localization Rp is a regular local 
ring. We will accomplish this by analyzing the rings R/p and R/p^. 

Let F' and V' be the Frobenius and Verschiebung endomorphisms of A, and 
choose an embedding i of A into A. The embedding l gives us a homomorphism 
from R to End A that sends F to F' — s and V to V' = s, and clearly p is contained 
in the kernel of this homomorphism. Therefore p is not the unit ideal. (We note 
that the fact that p is not the unit ideal tells us that s is coprime to £; for otherwise 
p would contain F and V, and F and V are coprime in R because A is ordinary — 
see [H Lem. 4.12, p. 2372].) 

On the other hand, since F = V = s mod p, we see that every power of F and V 
is congruent to an integer modulo p, so every element of R is congruent to an integer 
modulo p. Furthermore, since G p, we find that every element of R is congruent 
modulo p to a nonnegative integer less than i. This shows that R/p = F^, so p is 
prime. 

Now we analyze the ring R/p^. Note that p^ contains {F — s)^ ~ F"^ — 2sF + q 
and {V — s)^ = V'^ — 2sV + q. Using multiples of these elements to eliminate higher 
powers of F and V, we see that every element of R/p^ can be represented by an 
element of the form aF + bV + c. Using the fact that p^ contains £{F — s), and 
i{V — s), we see that every element of i?/p^ can be represented by an element of 
this form with the further restriction that a, 6, and c are nonnegative integers with 
a,b < £ and c < £'^. 

Now, p2 also contains (F - s){V - s) = 2q - {F + v)s = s{2s - {F + V)), and 
since s is coprime to £ and hence not in p, we see that p^ contains F + V — 2s. This 
shows that we can find representatives as above for which 6 = 0. 

Suppose, to obtain a contradiction, that ho{2s) is not divisible by £'^. Since 
F + V = 2s mod p^, we have = ho{F + V) = ho{2s) mod p^. This can only 
happen if ho{2s) is divisible by £, and then our assumption that ho{2s) is not 
divisible by £'^ implies that p^ contains £. This means that every element of R/p^ 
has a representative of the form aF + c where a and c are both non-negative integers 
less than £. In particular, p/p^ is a 1-dimcnsional i?/p-vector space, and so Rp is a 
regular local ring. 

Deligne [3] proved a result that implies that there is an equivalence of categories 
between the category of abelian varieties over k that are isogenous to A and the 
category of nonzero finitely-generated i?-submodules of K. This equivalence of 
categories is fleshed out in |12) : the only result we will use in our argument is that 
if our variety A corresponds to the isomorphism class of an i?-module 21 C K, then 
the i?-modules A[£] and 2l/£2l are isomorphic to one another. 

The image of A in ^ must sit inside the largest subgroup of A[£] on which F and 
V acts as s, so we would like to analyze the p-primary part of A[£]. This p-primary 
part is simply 2lp/^2tp, and since Rp is regular, this last module is isomorphic to 
i?p/p°, where p" is the largest power of p dividing £. The submodule of iJp/p" 
on which p acts trivially is p°^^/p°, which has order £. Since A has order greater 
than £, we see that A cannot be embedded in A[£], a contradiction. 

This proves the lemma in the case where A is simple. Now we turn to the general 
case. The decomposition of A up to isogeny corresponds to the factorization of /iq. 
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Suppose 

is the factorization of into powers of distinct irreducibles, and suppose, to obtain 
a contradiction, that ho{2s) is not divisible by As before, choose an embedding 
i of A into A. 

The radical of ho is the minimal polynomial of F + V , viewed as an element of 
End A, so A is killed by ho{F + V). Since A can be embedded in A, it is also killed 
by this polynomial in F + V. But since F + V = 2s on A, we find that ho{2s) 
kills A, and since A is i'-torsion, we see that /io(2s) is divisible by £. 

This means that exactly one prime factor hi of /iq has the property that hi(2s) is 
divisible by £, and for this i we must have = 1. By renumbering, we may assume 
that hi{2s) is divisible by £ and that ei — 1. 

Let H = hl^ ■■■h"/, so that H{2s) is coprime to £. If we apply H{F + V) to A, 
we obtain a subvariety Ai of A on which F + V satisfies hi. Since H{F + V) acts as 
H{2s) on A, we see that the image of i(A) under H{F + V) is simply i(A). Thus, 
i provides an embedding of A into the simple variety Ai. As we have shown, the 
existence of this embedding is inconsistent with the fact that hi{2s) is not divisible 
by £'^, and this contradiction proves the lemma. □ 

Proof of Theorem 13.11 Let E be an elliptic curve over k with real Weil polynomial 
equal to a; — 2s and let A be an abelian variety over k with real Weil polynomial 
equal to ho. Let e be the gluing exponent of i5" and A. Proposition 12 .81 says that e 
divides the reduced resultant of x — 2s and the radical of ho; this reduced resultant 
divides the resultant of a; — 2s and ho, which is the squarefree integer ho(2s), so e 
is squarefree. 

Suppose A is a nontrivial self-dual group scheme that can be embedded in a vari- 
ety isogenous to i?" as the kernel of a polarization, and that can also be embedded 
a variety isogenous to A as the kernel of a polarization. Let ^ be a prime divisor 
of the order of A; then the ^-primary part Ag of A is a nontrivial group scheme 
that can be embedded in a variety isogenous to E" and in a variety isogenous to A. 
Furthermore, since eAf = 0, and e is squarefree, we see that Ai is ^-torsion. And 
finally, since A is isomorphic to the kernel of a polarization and hence has square 
order, we see that the order of Ai is divisible by £'^. 

Frobenius and Verschiebung act on E as multiplication by the integer s, so they 
act on i?" and on all varieties isogenous to i?" in the same way. Since Ag can be 
embedded in a variety isogenous to E'", we see that Frobenius and Verschiebung 
act as multiplication by s on A^ as well. 

But then Ai satisfies the hypotheses of Lemma (3.21 so we find that ho{2s) is 
divisible by a contradiction. Thus, no nontrivial self-dual group scheme can be 
embedded as the kernel of a polarization both in a variety isogenous to i?" and in 
a variety isogenous to A. It follows from Proposition l2.4l that there is no curve over 
k with real Weil polynomial equal to h. □ 

4. Hermitian lattices 

We saw in Proposition 12.51 that if the Jacobian J of a curve C over a finite field 
is isogenous to a product Ax E, where A is an abelian variety and E is an elliptic 
curve with Hom(£', A) = {0}, then we can derive an upper bound on the degree of 
the smallest-degree map from C to an elliptic curve isogenous to E. Our goal in 
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this section is to prove a similar result when J is isogenous to ^ x E"^, for n > 
and E ordinary. 

Proposition 4.1. Suppose C is a curve over whose Jacobian is isogenous to a 
product A X E^^ , where n > 0, where E is an ordinary elliptic curve of trace t, and 
where A is an abelian variety such that the gluing exponent e = e{A, E) is finite. 
Let h be the real Weil polynomial of A and let b — gcd{e" , h{t)) . Let E' be any 
elliptic curve isogenous to E whose endomorphism ring is generated over Z by the 
Frobenius. Then there is a map from C to E' of degree at most 

72„&'/V|i'-4q|/4, 

where j2n "is the Hermite constant for dimension 2n. 

Remark. We have 

7^ = 4/3, 7^ = 4, 76 = 64/3, 78 = 256, and 7^° < 5669. 

The value of 72 was given by Hermite , the value of 74 by Korkine and Zolotar- 
eff [in], and the values of 76 and 73 by Blichfeldt [2 . The upper bound for 710 
follows from an estimate of Blichfeldt [Ij. General upper bounds for 7„ can be 
found in ^ §38]. 

In any specific instance, it may be possible to improve the bound from Propo- 
sition 14.11 by using refinements of the individual lemmas from which the proof of 
the proposition is built. We turn now to these lemmas. After presenting the proof 
of Proposition 14.11 we will explore some cases in which the proposition can be 
improved. 

Lemma 4.2. Let E be an ordinary elliptic curve over Fq, let R be the endomor- 
phism ring of E, let A be an abelian variety isogenous to E" .such that R is contained 
in the center o/EndA, and let K be a polarization of A. Let Q : Hom(£', A) — > Z 
be the map that sends to and that sends a nonzero morphism ip to the square 
root of the degree of the pullback polarization 'ip*A. Then Q is a positive definite 
quadratic form onHom{E,A), the determinant of Q is equal to |(disci?)/4|" deg A, 
and there is a nonzero element ip of Hom(£', A) .such that 

QW < I2n (degA)i/(2")^|disci?|/4. 

Remark. By the determinant of a positive definite quadratic form Q : i — >■ Z on a 
free Z-module L, we mean the following: Let B be the unique symmetric bilinear 
form L X L Q such that Q{x) = B{x^ x) for all x. Then we define the determinant 
of Q to be the determinant of the Gram matrix for B. 

If we let L* = Hom(L, Z) be the dual of L, then 2B defines a homomorphism 
b:L^ L*, and we have 

detg = (l/2)'-^"'^^[L* 

Proof of Lemma 14.21 Let p be the characteristic of Fg, let tt and W be the Frobenius 
and Verschiebung endomorphisms of E, and let Rq be the subring Z[7r,7f] of R. 
The theory of Deligne modules [S1[T2] shows that the category of abelian varieties 
over Fg that are isogenous to some power of E is equivalent to the category of 
torsion-free finitely generated i?o-niodules. The equivalence depends on a choice: 
we must specify an embedding e :W C oi the Witt vectors W over Fg into the 
complex numbers. The equivalence sends an abelian variety to the first integral 
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homology group of the complex abelian variety obtained by base-extension (via e) 
from the canonical lift of the variety. It follows from the irreducibility of Hilbert 
class polynomials that we can choose the embedding e so that the equivalence takes 
the elliptic curve E to the i?o-niodule R. 

We recall from [121 §4] how the concept of a polarization translates to the cate- 
gory of Deligne modules, at least in the special case we are considering. Let K be 
the quotient field of Rq. The embedding e determines a p-adic valuation v on the 
field of algebraic numbers sitting inside the complex numbers; we let : X — > C be 
the complex embedding of K such that i'{ip{T:)) > 0. A polarization on a finitely- 
generated torsion-free i?o-niodule M is a skew-Hermitian form 

S:{M(E)Q) X (M® Q) ^ if 

such that Ti'x/Q S{M, M) C Z and such that (fi{S{x, x)) lies in the lower half-plane 
for all nonzero x € M. (Note that (p{S{x,x)) must be pure imaginary, since S is 
skew-Hermitian.) The composition Ttx/q°S gives a map Al — > Hom(M, Z); the 
degree of the polarization is the size of the cokernel of this map. 

Now let M be the i?o-inodule corresponding to the n-dimensional variety A. 
Since R lies in the center of the endomorphism ring of M, we see that the Rq- 
module structure of M extends to an _R-module structure. Thus, every element x 
of M determines a map ■ R ^ M defined by ck^(r) ~ rx, and every map from R 
to M is of this form. We find that Hom(£', A) M. 

Let S be the polarization on M corresponding to the polarization A of A, and 
let ip he a nonzero map from E to A, corresponding to a map a: R ~> M, say 
a(r) = rx for a nonzero x G M. The polarization ip*A then corresponds to the 
skew-Hermitian form 

: K X K ^ K 

defined by 

Sx{u, v) = S{ux, vx) — uvS{x, x). 

Our map R —J- Hom(i?, Z) is then 

w i-> (u i-> Tr/f/Q uvS{x, x)) , 

and the size of the cokernel of this map is the index of the i?-module S{x, x)R 
inside the trace dual of R. Let 5 be a generator of the different of R, chosen so 
that ip{6) is pure imaginary and in the upper half plane. Then the size of the 
cokernel is the norm of SS{x, x). Since S{x, x) and S are both pure imaginary, and 
their images under (p lie in opposite half-planes, the product SS{x,x) is a positive 
rational number, so its norm is just its square. Thus, under the identification 
Hom(i?, A) = M, the function Q in the statement of the lemma is the map i\f — > Z 
defined by Q{x) — SS{x, x). Therefore Q is a quadratic form. 

We compute that the symmetric bilinear form B on AI such that Q{x) — B{x, x) 
is given by 

B{x,y) = (l/2)TrK/Q SS{x,y). 
The map M — > Hom(Af, Z) determined by Tr^/Qo5 has cokernel of size degA; 
replacing S with 6S increases the size of the cokernel by Norm((5)" = |disci?|". 
Therefore 

det Q = (1/2)'-^"'^^ Idisc i?r deg A 
= |(disci?)/4|"degA. 
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The final statement of the lemma follows from ^lOj Thm. 38.1, p. 386] or [H 
Thm. 12.2.1, p. 260]. □ 

Lemma 4.3. Let C be a curve over a field k, let E be an elliptic curve over k, and 
let fi: E E and X : Jac C Jac C be the canonical polarizations of E and of the 
Jacobian of C, respectively. Suppose C has a k-rational divisor D of degree 1, and 
let e :C ^ Jac C be the embedding that sends a point P to the class of the divisor 
P - D. 

Suppose Tp is a nonzero homomorphism from E to Jac C, so that ^pXijj — d/i for 
some positive integer d. Let ip : C ^ E be the map fi^^iJjXe. Then ip = ip* , and (p 
has degree d. 

Proof. The maps in the lemma can be arranged into the following diagram: 



E- 



E- 



E 



■ Jac C ■ 



• Jac (7 



Inserting another copy of Jac C into the bottom row we obtain 



E- 



f 
E- 



E 



■ Jac G ■ 



Jac C ■ 



■ JacC 



and we see that the middle vertical map from Jac C to is equal to iy9* . Lemma 14^ 
below, shows that then we must have tp = (p* , which is the first part of the conclusion 
of the lemma. Since is equal to multiplication by the degree of ip, we find 

that deg ip = d. □ 



Lemma 4.4. Let f :C ^ D be a nonconstant morphism of curves over a field k, 
and let : JacC — ^ JacZ? and f* : JacD — > JacC be the associated push-forward 
and pullback maps between the Jacobians of C and D. Under the natural isomor- 
phisms between JacC and JacD and their dual varieties, the isogenics and f* 
are dual to one another. 

Remark. This statement is proven by Mumford ^29, §1]. Mumford assumes that 
/ has degree 2 because his paper is concerned with double covers; however, the 
proof does not use this assumption. For the convenience of the reader, we include 
a version of his proof here. 

Proof of Lemma 14.41 Let Xc and Ad be the canonical principal polarizations of 
Jac C and Jac D. It suffices to prove the lemma in the case where k is algebraically 
closed, so we may assume that C has a fc-rational point P. Let gc be the embedding 
of C into Jac C that sends a point Q to the class of the divisor Q — P, and let gjy 
be the embedding of D into Jac D that sends a point Q to the class of the divisor 
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Q — f{P)- Then we have a commutative diagram 



C Jac C 



D 



Jac D. 



Applying the functor Pic , we obtain the diagram 

JacC ■ 
/* 

Jac D -i-^ — Jac D, 

which expresses the fact that /* is isomorphic to the dual of /*; that is, /* and /* 
are dual to one another. □ 




Proof of Proposition 14.11 Suppose C is a curve over a finite field Fq whose Jacobian 
is isogenous to a product A x E", where n > 0, where E is an ordinary elliptic 
curve with trace t, and where A is an abelian variety such that the gluing exponent 
e = E{A, E) is finite. Let E' be an ordinary elliptic curve over Fq isogenous to E 
such that the endomorphism ring R of E' is generated by the Frobenius; this means 
that the discriminant of R is equal to — Aq. 

Lemma 12.31 says that there is a variety A' isogenous to A, a variety B isogenous 
to £'", and an exact sequence 







A ^ A' X B ^ JacC^ 



where A is a finite group scheme and the induced maps A — )■ A' and A — _B are 
monomorphisms. Let A be the canonical principal polarization of JacC. Again 
by Lemma 12. 3[ pulling A back to B gives us a polarization A of -B with kernel 
isomorphic to A. The lemma also says that A can be embedded into the e-torsion 
of B, so the order of A is a divisor of e^". 

Let ?7a G End A be the sum of the Frobenius and Verschiebung endomorphisms 
of A, and let 77 e End A' be the sum of the Frobenius and Verschiebung endomor- 
phisms of A' . Since A embeds into B, we have 77^ = i on A. Thus, the image 
of A in A' must lie in the kernel of the endomorphism rj — t. The degree of this 
endomorphism is the constant term of its characteristic polynomial, and since the 
characteristic polynomial of rj is h^, the characteristic polynomial of rj—t is h{x+t)'^ , 
whose constant term is h{t)'^. Thus, A embeds into a group scheme of order h{t)'^, 
so the order of A is a divisor of b^, where b = gcd(e", h{t)). 

Let Q be the map that sends a nonzero homomorphism ip : E' ^ B to the square 
root of the degree of the pullback polarization ?/;*A. Lemma [4.21 savs that there is 
a nonzero element ip of Hom(£'', B) such that 



< I2n (#A)i/(2")^|disci?|/4< 72„ 6i/V|disci?|/4. 
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Thus we have a diagram 

iA*A - 

E ^E 



B 

Jac C — Jac C 

where the vertical arrows on the right are the dual morphisms of the vertical arrows 
on the left. Using Lemma l4.3l we obtain a map from C to E whose degree d is equal 
to Q(V'), so that d < feV" ^1^2 _ 4^1/4 □ 

As we mentioned earlier, the bound in Proposition 14.11 can sometimes be im- 
proved. There are two places in the proof of the proposition where improvements 
can be made: First, when one has specific varieties A and E in hand, the estimate 
for the size of the group scheme A can often be sharpened by a more thorough 
analysis of the e{A, £^)-torsion group schemes that can be embedded in a variety 
isogenous to E"- and in a variety isogenous to A. Second, we obtain upper bounds 
on short vectors for the quadratic form Q by using general bounds on short vectors 
in lattices. But the lattices we are considering are quite special — they come pro- 
vided with an action of an imaginary quadratic order — so there is no reason to 
suspect that the bounds for general lattices will be sharp in our situation. Improv- 
ing upper bounds on the lengths of short vectors in such lattices is helpful enough 
in practice that we will devote the remainder of this section to doing so. 

We will start by studying pullbacks of polarizations on powers of elliptic curves. 
Then we will focus on the very special case of ordinary elliptic curves over finite 
fields that are isogenous to no other curves. 

Lemma 4.5. Let E be an elliptic curve over a field k and let R — End_B, so that 
R is a ring with a positive involution. Let Aq be the canonical principal polarization 
of E. Fix an integer n > 0, and let Aq denote the product polarization Xq of E^ . 
Let $„ denote the map from polarizations of E" to End E" = Af„ (R) that sends a 
polarization A of E" to the element Aq A of End E". Then: 

(1) The image o/$„ is the set of positive definite Hermitian matrices in M„{R). 

(2) The degree of a polarization A of E" is the square of the determinant of 
$(A). 

(3) Let A be a polarization of E'" and let H be the Hermitian form on i?" 
determined by $„(A). Lf a:E ^ E"^ is a nonzero map corresponding to a 
vector V of elements of R, then the polarization a* A of E is equal to dXo, 
where d — H{v, v). 

Proof. In general, if A is an abelian variety with a principal polarization /io, the 
map II IJ-Q^fJ- identifies the set of polarizations of A with the set of elements of 
End A that are fixed by the Rosati involution associated to /xg and whose minimal 
polynomials have only positive real roots. (See the final paragraph of §21 of [28].) 
The Rosati involution on Endi?" associated to the product polarization Aq is the 
conjugate transpose, and the roots of the minimal polynomial of a Hermitian matrix 
are all positive precisely when the matrix is positive definite. This proves (1). 
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The degree of an element of End i?" is equal to the norm (from End E to Z) of 
its determinant. Since the determinant of a Hermitian matrix already lies in Z, its 
norm is just its square. This proves (2). 

Item (3) follows from noting that upon identifying E with its dual via Aq, the 
dual map a : i?" — > is given by the conjugate transpose v* of the vector v. The 
puUback of A to i? is then given by u*$„(A)7jAo, and this is H{v, v)Xo. □ 

Given an imaginary quadratic order R, an integer n > 0, and an integer D > 0, 
let d{R, n, D) be the smallest integer d with the following property: For every 
positive definite Hermitian matrix M e Mn{R) of determinant D, the associated 
Hermitian form over i?" has a short vector of length at most d. The next lemma 
shows that in a very special case, the function d(R, n, D) gives a bound on the 
minimum nonzero value of the function Q from Lemma l4.2l 

Lemma 4.6. Let E he an elliptic curve over F^, let t he the trace of E, and suppose 
— 4g is the discriminant of the maximal order R of an imaginary quadratic field 
of class numher 1. Let A be a polarization of a variety A isogenous to E^ , and 
let Q : End(_B, A) Ti he as in Lemma 14.21 Then there is a nonzero element 
tp e End(_B, A) such that Q{tp) < d{R, n, y/degA). 

Proof. The theory of Hermitian modules :24, Appendix] , or of Deligne modules [51 
[T2j , shows that the varieties isogenous to E" correspond to rank-n modules over R. 
There is only one such module up to isomorphism, because R has class number 1. 
Therefore A is isomorphic to E". 

Let $„ be as in Lemma iLSl and let M be the Hermitian matrix "I>„(A), so that 
part (2) of the lemma shows that dct M = ^/deg A. Let H be the Hermitian form 
on i?" determined by M. If ip : E — i?" corresponds to a vector v g i?", then 
part (3) of Lemma 14.51 shows that Q{iIj) = H{v,v) < d{R, n, -y/deg A). □ 

Lemma 4.7. The integer entries in Tahles]^^ give correct values of d{R,n, D). 

Proof. Our proof is computational. We will outline two algorithms for computing 
d{R,n^D) when i? is a maximal order of class number 1. We have implemented 
these algorithms in Magma, and the resulting programs are available at the URL 
mentioned in the introduction — follow the links related to this paper, and down- 
load the file HermitianForms .magma. The entries in Tables [THS] reflect the output 
of these programs. 

Let R be the maximal order of an imaginary quadratic field K of class number 1. 
Our first algorithm will compute, for any rank n and determinant D, the value of 
d{R,n,D). 

Let M be an n-by-n Hermitian matrix with entries in R and let L be the cor- 
responding Hermitian i?-lattice. For each positive integer i < n we define the i 'th 
successive R-minimum of L to be the smallest integer Ni such that the elements of 
L of length Ni or less span a iC- vector space of dimension at least i. 

Let the successive i?-minima of L be Ni,. .. ,Nn. Let Lz be the i?- lattice L 
viewed as a rank-2n lattice over Z, and let Afi, . . . , M2n be the successive minima 
of Lz. Then 

Ni = Ml 
N2 < M3 
N3 < M5 



16 



HOWE AND LAUTER 



D 


Rank n 




L> 


Rank n 




L» 


Rank n 


2 


3 


4 


5 


2 


3 


4 


5 


2 


3 


4 


5 


1 


1 


1 


1 


1 




11 


3 


2 


2 






21 


5 


3 


3 


2 


2 


1 


1 


1 






12 


4 


3 


2 


2 




22 


5 


2 


3 




3 


2 


2 


2 


2 




13 


4 


2 


2 


2 




23 


5 


3 


2 




4 


2 


2 


2 


2 




14 


3 


2 


2 






24 


6 


4 


3 




5 


2 


1 


2 






15 


4 


3 


2 






25 


5 


3 


3 


2 


6 


3 


2 


2 






16 


4 


3 


3 


3 




26 


5 


3 


2 




7 


2 


2 


2 


2 




17 


4 


3 


2 






27 


6 


3 


3 


3 


8 


3 


2 


2 






18 


5 


3 


3 






28 


5 


3 


3 


3 


9 


3 


3 


3 


2 




19 


4 


3 


2 


2 




29 


6 


3 


3 




10 


2 


2 


2 






20 


4 


3 


2 






30 


6 


4 


3 





Table 1. Values of d{R,n,D) for the quadratic order R of dis- 
criminant —3. Dashes indicate values that we have not computed. 



and so on, so that 

(iVi • • • Nn)^ = N^Nl ---Nl 

< {A-hM2){KhMi) ■ ■ ■ (M2„-iM2„). 
Arguing as in the proof of Lemma 14.21 we find that 

detLz = (detM)2(|disci?|/4)", 
and combining this with [H Thm 12.2.2, p. 262] we find that 
iVi • • • iV„ < 72"„ (det M) (Idisc R\ /Af'^ . 

From this, we obtain an upper bound on A^i. 

Let this initial upper bound be B. We let a variable s take on successive values 
i3, B — 1, and so on, down to 1. For a given value of s, we try to construct R- 
lattices whose successive i?-minima are all greater than or equal to s. The first s 
for which we succeed in constructing such a lattice will be the value of d{R, n, D). 
We attempt to construct an i?-lattice with A^i = s as follows: 

Suppose the successive i?-minima of L are all s or larger. The product bound 
above gives us a finite set of values of the Ni to consider. For each possible set 
of Ni, suppose we have an i?-lattice L with those minima. Consider the sublattice 
L' of L generated by vectors giving those minima. The Gram matrix for L' will 
have the Ni on its diagonal, and we get bounds for the other entries from the fact 
that each rank-2 sublattice of V is positive definite and has no vectors of length 
less than s. So we can enumerate all of the L', and then see whether any of the L' 
have superlattices with discriminant D and with no vectors of length less than s. 

Even without a formal complexity analysis, it is not hard to see that the work 
required to run the algorithm outlined above grows at least on the order of 

(72„/2)("'-")/2^("-i)/2 Idisc 

We have implemented the algorithm for n = 2, 3, 4, and 5 in Magma, in the routines 
FindMinimum2, FindMinimumS, FindMinimum4, and FindMinimumS, respectively. In 
practice, for n = b our implementation took more time to run than we were willing 
to wait, and for n = 4 we only ran the algorithm for the orders of discriminants —3 
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Table 2. Values of d{R,n,D) for the quadratic order R of dis- 
criminant —4. Dashes indicate values that we have not computed. 



and —4. AU of the values in the tables for n = 5, and most of the values for n = 4, 
came from running our second algorithm, which computes d{R, n, D) only in the 
case where D is the norm of an element of R. 

We must introduce some additional notation before outlining the second algo- 
rithm. Throughout, R will continue to denote the maximal order of an imaginary 
quadratic field K with class number 1. 

Let L be the lattice i?", viewed as a subset of iiT". For every prime ideal p of R, 
we fix a finite set iSp of matrices in Af„(i?) such that 

{P'^L-.PeSp} 

is the complete set of the superlattices M D L in such that M/L = R/f as 
i?- modules. For example, if tt is a generator of the principal ideal p, and if X C i? 
is a set of representatives for the residue classes of p, then one choice for 5p would 
be 





TT 





•• 


• 0" 








"1 





•• 


• 0" 








X2 


1 


•• 


• 











TT 


•• 


• 






< 


X3 





1 • • 


• 


■.x.,ex 


> u < 









1 • • 


• 


■.Xi e X 


> u 









•• 


• 1_ 


J 











•• 


• 1_ 


J 





We say that two Hermitian matrices A and B in Mn{R) are isomorphic to one 
another if there is an invertible C G M„(i?) such that A = C*BC, where C* is 
the conjugate transpose of C. We also fix a finite set U of representatives of the 
isomorphism classes of unimodular Hermitian matrices in Mn{R). For the R and 
n we will be considering, Schiemann 1341 has computed such sets U. 

Lemma 4.8. If A is a matrix in Mn{R) whose determinant generates a prime 
ideal p, then there is an element P of and an invertible C € Mn{R) such that 
A = CP. 

Proof. The lattice M = A~^L is a superlattice of L such that M/L = R/p, so there 
is a P e 5p so that A~^L = P-^L. If we set C = AP'^ then CL ^ L, so C is an 
invertible element of Mn{R). □ 
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5 


1 


1 


2 


2 


2 




11 


3 


3 


3 


3 




21 


7 


4 






2 


2 


2 


2 


2 




12 


4 


3 








22 


5 


4 


3 


3 


3 


2 


2 








13 


4 


4 








23 


5 


4 


4 


3 


4 


2 


2 


2 


2 




14 


5 


3 


3 


3 




24 


6 


4 






5 


3 


2 








15 


4 


3 








25 


6 


4 


4 


3 


6 


2 


2 








16 


4 


4 


4 


4 




26 


6 


4 






7 


3 


3 


3 


3 




17 


5 


3 








27 


7 


6 






8 


4 


4 


2 


2 




18 


6 


4 


4 


3 




28 


7 


5 


4 


4 


9 


4 


3 


3 


3 




19 


5 


3 








29 


6 


5 


4 




10 


3 


2 








20 


6 


4 








30 


6 


5 







Table 3. Values of d{R,n,D) for the quadratic order R of dis- 
criminant —7. Dashes indicate values that we have not computed. 



Lemma 4.9. Suppose A is a Hermitian matrix in Mn{R) whose determinant is 
equal to xx for some x in R. Write the ideal xR as a product pi • • - p^ of prime 
ideals. Then A is isomorphic to a product 

where U £ U and Pi £ 5p . . 

Proof. We prove this statement by induction on the number r of prime factors 
of xR. The statement is certainly true when r = 0, because in that case det A = 1 
and A is isomorphic to one of the matrices in U. 

Suppose r > 0, and let q = pi. Let M = A^^L and let G be the finite R- 
module M/L, whose cardinality is (det^)^. Pick S G R with — disci?, so 
that i5 is a purely imaginary generator of the different of R. We define a pairing 
6:G X Q/Z by setting 

b{x,y) — Tt:{x* Ay / S) mod Z; 

it is easy to check that this pairing is well-defined, and by using the fact that 
{1/5)L is the trace dual of L, we see that h is nondegenerate. Note also that h is 
alternating, and that for all r g i? and x,y G G we have 6(rx, y) = b{x, fy), so that 
in the terminology of |12j . b is semi-balanced. 

The ideal q occurs in the Jordan-Holder decomposition for the i?-module G, so 
the q-torsion T of G is nontrivial. We claim that we can find a 1-dimensional i?/q- 
vector subspace of T on which the pairing b is identically 0. If q ^ q this follows 
from [12l Lem. 7.2, p. 2378]. If q = q and the dimension of T as a i?/q-vector 
space is at least 2, then this follows from [TH Lem. 7.3, p. 2378]. If q — q and 
T is 1-dimensional, we let U be the q-power torsion of the i?-module G. Since q^ 
divides det A, the i?-module U is strictly larger than T, and the annihilator of T 
in U is nontrivial. Thus, the q-torsion of the annihilator of T must be T itself, so 
b restricted to T is trivial. This proves the claim. 

Let N be the sublattice of M consisting of elements that reduce modulo L to 
elements of T. Then is a superlattice of L with the property that N/L = R/q, 
so there is an element Q of 5q such that N — Q^^L. 
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4 
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12 
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4 
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4 




22 


7 
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2 




13 
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3 








23 
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4 
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14 
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24 
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2 








15 
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3 








25 


10 
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2 




16 
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4 




26 
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4 
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2 








17 
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3 




27 
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4 
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4 
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4 


4 




18 


6 


4 


4 


4 




28 


8 


4 






9 


6 


3 


4 


3 




19 


6 


4 


4 


3 




29 


7 


4 






10 


4 


3 








20 


6 


4 








30 


8 


5 







Table 4. Values of d{R,n,D) for the quadratic order R of dis- 
criminant —8. Dashes indicate values that we have not computed. 



Let X and y be arbitrary elements of L. Since b is trivial on N/L, we have 
Tr((Q-ix)*A(Q-iy)/5) e Z, 

so that 

Tr{x* Q-^*AQ-^y/S) e Z for all x,y e L. 
If we set B = Q^^* AQ^^ , we see that By/5 must lie in the trace dual of L, which 
is {1/S)L, so B must send L to L. In other words, the entries of B must all be 
elements of R. This shows that A — Q*BQ for a Hermitian matrix _B in A/„(_R) 
whose determinant can be written yy for an element y of R with yi? = p2 • • • pr- 
Applying the induction hypothesis, we find that 

B = c*P2^3 • • • PrUp; ■ ■ ■ p^p;c 

where each Pi lies in Sp-^ where U lies in lA^ and where C is an invertible element 
of M„(i?). Thus 

A = Q*c*P2P3 ■ ■ ■ PrUp; ■ ■ ■ p;p;cQ. 

Note that Q*C* is a matrix whose determinant generates the prime ideal pi, so by 
Lemma [4.81 there is an element Pi of Sp^ and an invertible D e M„(i?) such that 
Q*C* = DPi. Thus, we find that 

A = DP1P2P3 ■ ■ ■ PrUP; ■ ■ ■ p;p^p^D*. 

In other words, A is isomorphic to a product as in the statement of the lemma. □ 

Lemma l4!9l thus gives us an easy way to enumerate all of the isomorphism classes 
of Hermitian matrices in Mn{R) of a given determinant, provided that the deter- 
minant is a norm. For each isomorphism class, we can compute the shortest vector 
using standard techniques that are built into Magma, and in this way we can com- 
pute an upper bound on the lengths of the short vectors of such matrices. This 
completes the proof of Lemma l477l □ 

Remark. The proof of Lemma 14.91 is very similar to the proof of 12, Prop. 7.1, 
p. 2378], and indeed we initially thought of Lemma [4.91 not as a statement about 
the decomposition of Hermitian matrices but rather as a statement about the de- 
composition of non-principal polarizations of abelian varieties. 
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5 






2 


1 
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28 
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4 
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10 
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10 
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4 








20 


8 
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4 




30 


9 


5 







Table 5. Values of d{R,n,D) for the quadratic order R of dis- 
criminant — 11. Dashes indicate values that we have not computed. 



As an apphcation of the sharp values of d{R,n, D), we prove a generalization 
of [Ml Thm. 4, pp. 95-96]. 

Proposition 4.10. Let q be a prime power, let m = [2^/gJ, and suppose there is 
an elliptic curve E over Fq with trace —m. Let F be an arbitrary elliptic curve 
over Fq. Then there is no Jacobian over Fq isogenous to E^^^ x F if m'^ — 4g, g, 
and the trace of F lie in the following table: 



— 4g 


9 


trace F 


-3 


3 


-TO + 2 




4 


-TO + 2 




4 


— TO + 5 




5 


-TO + 2 


-4 


3 


— TO + 3 


-11 


3 


-TO + 2 



Proof. Suppose m? — Aq, g, and the trace of F lie in the table, and suppose C is 
a curve of genus g over Fq whose Jacobian is isogenous to E^~^ x F. Write the 
trace of as — to + /. Then the reduced resultant of the real Weil polynomials of 
E and F is /, and the largest group scheme that can be embedded in the /-torsion 
of an elliptic curve isogenous to F has order Pulling the principal polarization 
of JacC back to E^^^ gives us a polarization of degree corresponding to a 
positive definite Hermitian matrix, with determinant /, over the quadratic order R 
of discriminant to^ — Aq. Looking in Tables [1] [21 and[5l we find that for all of the 
cases listed in the proposition, the value of d{R, g—l,f) is 1, so that the Hermitian 
form associated to this matrix has a vector of length 1. This vector gives us an 
embedding of E into E^^^; let -0 be the composition of this embedding with the 
map E^~^ — JacC Then Lemma 14.51 shows that ^p pulls the principal polarization 
of C back to the principal polarization of E, and Lemma 14.31 shows that there is a 
map of degree 1 from C to E. This is clearly impossible, so there must not be a C 
with Jacobian isogenous to E^^^ x F. □ 



BOUNDING THE NUMBER OF POINTS ON CURVES 



21 



5. Galois descent 

For some isogeny classes C of abelian varieties over a finite field fc, one can 
show that every principally-polarized variety in C can be defined over a subfield kg 
of fc; it follows that every Jacobian in C comes from a curve that can be defined 
over fco- This reduces the problem of determining whether there are Jacobians in C 
to the problem of determining whether there are Jacobians in a collection of isogeny 
classes over a smaller field. This idea was used in 38) pp- Se42-Se43] and in [23] : 
the appendix to the latter paper describes some methods for determining whether 
principally-polarized varieties can be defined over subfields. 

In this section we give a simple necessary and sufficient condition for determin- 
ing whether the entire category of varieties in an ordinary isogeny class C can be 
descended in this way. To begin, we set some notation and make a formal definition. 

Let fco be a finite field, Cq an isogeny class of abelian varieties over kg, and fc a 
finite extension of fco, say of degree e over fcp. Base extension by fc/fco takes the 
isogeny class Cq to an isogeny class C over fc, and the base extension functor respects 
properties such as the degrees of isogenics, the duality of varieties, and whether or 
not an isogeny is a polarization. 

Definition 5.1. We say that C descends to Cq if base extension induces an equiv- 
alence between the category of abelian varieties in Cq and the category of abelian 
varieties in C. 

Let C be an arbitrary isogeny class of ordinary abelian varieties over a finite 
field fc, and let A be any variety in C. Let tt and n be the Frobenius and Ver- 
schiebung endomorphisms of A, respectively; then the subring R :— Z[7r,7f] of 
End A is contained in the center K of the ring E :— (End A) Q. Up to isomor- 
phism, the ring R and the Q-algebras K and E do not depend on the choice of A; 
we denote them by Rc, Kq, and Eq. The algebra K is a. product of CM fields, and 
R is an order in K. Furthermore, complex conjugation on K sends tt to tF. 

Theorem 5.2. LetC be an isogeny class of ordinary abelian varieties over a finite 
field k that contains an index-e subfield fco. 

// there is an element ttq of Rc such that n — ttq, then the characteristic polyno- 
mial of ttq {as an element of Ec) is the Weil polynomial for an isogeny class Cq of 
abelian varieties over ko, and C descends to Cq. 

Conversely, if C descends to an isogeny class Cq over fco, then there is a ttq in 
Rc whose characteristic polynomial {as an element of Ec) is equal to the Weil 
polynomial for Cq and such that n — t:^. 

Proof. Let q — ^k and go = T^^o, so that q = qg, and let p be the characteristic 
of fc. Let R = Rc and K = Kc- 

Suppose there is an element tto of R such that tt — ttq, and let g be its charac- 
teristic polynomial. The product ttqitq of ttq with its complex conjugate is totally 
positive and real, and since 

(TToTfo)" = TrW=q = qQ 

we see that ttqitq ~ qQ. This shows that all of the complex roots of g have magni- 
tude y/qo, so all of the roots oi g are go-Weil numbers. To show that the correspond- 
ing isogeny class of varieties is ordinary, we must show that for every homomorphism 
(fi of Kc to Qp, one of the numbers ip{TTo) and <p(7fo) is a unit and the other is not. 
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But this follows from the fact that for each t^, one of the numbers </'(i'o) ^-nd 'p(7fg) 
is a unit and the other is not, which is true because C is ordinary. The Honda- Tate 
theorem then shows that g is the Weil polynomial of an isogeny class Cq of ordinary 
abelian varieties over fco. 

Let / be the Weil polynomial of C, and let / = fl'^ ■ ■ ■ f!^^ be its factorization 
into powers of distinct irreducibles. Each fi defines a CM- field Ki, and K is the 
product of these Ki. Likewise, we can write the factorization oi g as g = gl^ ■ ■ ■ g!^'' , 
where each gi also defines Ki . 

Let Rq be the ring Z[7ro,7ro], so that Rq = Rcg- Deligne's theorem on ordinary 
abelian varieties |5j shows that the category of abelian varieties in Co is equivalent 
to the category of finitely generated i?o-niodules that can be embedded in V :— 
X • • • X if^'' as submodules whose images span y as a Q-vector space. (The 
first author |12j has shown how dual varieties and polarizations can be interpreted 
in this category of i?o-niodules.) Likewise, the category of abelian varieties in C is 
equivalent to the category of finitely generated i?-modules that can be embedded 
in V as submodules whose images span y as a Q-vector space. The base extension 
functor sends an i?o-niodule M to the same module, viewed as a module over the 
subring Z[7rg, Wg] = R oi Rq. But since ttq and tFq lie in i?, we have R = Rq, so base 
extension gives an equivalence of categories. This shows that C descends to Co, and 
proves the first statement of the theorem. 

Now assume that C is an ordinary isogeny class that descends to an isogeny class 
Co over fco. Clearly Co must also be ordinary. Let Rq = Rco, and let tto G Rq be 
the Frobenius for Co- Then the Frobenius tt for the isogeny class C is 7r§, and the 
ring R = Rq is isomorphic to the subring Z[7rQ,7f3] of Rq. 

We know that Rq is contained in the center of the endomorphism ring of every 
variety in Cq, and it follows from Ab, Thm. 7.4, p. 554] or from [5] that there exist 
varieties in Co whose endomorphism rings have centers equal to Rq. Thus, Rq can 
be characterized as the smallest ring that occurs as the center of the endomorphism 
ring of a variety in Co. Likewise, R is the smallest ring that occurs as the center of 
the endomorphism ring of a variety in C. Since we are assuming that base extension 
gives an equivalence of categories from Co to C, we find that we must have Rq R. 
It follows that the natural inclusion R = Z[7rQ,7Fg] C Rq is an isomorphism, so R 
contains an element ttq whose characteristic polynomial is the Weil polynomial for 
Co and with tt — ttq. □ 

Remark. We could also have proven Theorem 15.21 by using Theoremes 6 and 7 
from [231 §§4,5] to show that each variety in C, and each polarization of each variety 
in C, descends to fco- However, we felt that the argument above, which gives us an 
entire equivalence of categories between the isogeny classes C and Co all at once, 
was worth the small additional effort of introducing Deligne modules into the proof. 

If A is an abelian variety over a finite field F^, the standard quadratic twist 
A' of A is the twist of A corresponding to the element of the cohomology set 
H^{GalFq/Fq,Aut A) represented by the cocycle that sends the qth-power Frobe- 
nius automorphism of Fq to the automorphism —1 of A. Suppose C is an isogeny 
class of abelian varieties over a finite field. The quadratic twist C of C is the isogeny 
class consisting of the standard quadratic twists of the elements of C. If the Weil 
polynomial of C is f{x), then the Weil polynomial of C is f{-~x). 



BOUNDING THE NUMBER OF POINTS ON CURVES 



23 



The next result shows how Theorem 1 5 . 2 1 can help us show there are no Jacobians 
in an isogeny class. 

Theorem 5.3. Suppose C is an isogeny class of ordinary abelian varieties over a 
finite field k that descends to an isogeny class Co over a subfield fco of k of index e, 
and suppose C is a curve over k whose Jacobian lies in C. 

(1) If e is odd, then C has a model over fco whose Jacobian lies in Cq. 

(2) // e is even, then C has a model over fco whose Jacobian lies either in Cq 
or in the quadratic twist of Cq. 

Thus, to show that there are no Jacobians in C, it suffices to show there are no 
Jacobians in Co and, if e is even, in the quadratic twist of Cq. 

Proof. If C is hyperelliptic, Theoreme 4 of the appendix to [25 shows that C has 
a model over fco whose Jacobian lies in Co- If C is not hyperelliptic, Theoreme 5 of 
the same appendix shows that C has a model Co over fco whose Jacobian has an 
£-twist that lies in Co, where e is a homomorphism from Galfc/fco to {±1}. If e is 
odd £ must be trivial, so JacCo lies in Co, and we get statement (1) of the theorem. 
If e is even, then the e-twist is either trivial or the standard quadratic twist, and 
we get statement (2). □ 

6. Magma implementation 

As we indicated in the introduction, wc have implemented our various tests in 
Magma. The main program is isogeny_classes(q,g,N), which takes as input a 
prime power q, a genus g, and a desired number of points N . Using the algorithm 
outlined in (14| . we enumerate all of the monic degree-g polynomials in 'Zi[x\ whose 
leading terms are + {N — q — l)x^~^ and all of whose roots are real numbers of 
absolute value at most 2y/q. This set of polynomials includes the set of real Weil 
polynomials of Jacobians of curves with N points. For each such polynomial /, the 
program runs the subroutine process_isogeny_class, which answers 'no', 'maybe', 
or 'yes' to the question "Is there a Jacobian whose real Weil polynomial is equal 
to /?" 

The procedure process_isogeny_class, when supplied with a polynomial, per- 
forms the following steps: 

(1) The procedure checks whether the polynomial corresponds to an isogeny 
class of abelian varieties; that is, it checks whether the polynomial satisfies 
the conditions of the Honda-Tate theorem [43l Theoreme 1, p. 96]. If not, 
the answer to the question is 'no'. 

(2) If the dimension of the isogeny class is 2, the procedure checks whether 
it meets the conditions of the Howe/Nart/Ritzenthaler classification of 2- 
dimensional isogeny classes that contain Jacobians [15] . The answer to the 
question is 'yes' or 'no', accordingly. 

(3) The procedure checks whether the Weil polynomial predicts a non-negative 
number of degree-d places for all d less than or equal to the genus. (The 
isogeny classes returned by isogeny .classes () have this property, but for 
isogeny classes that arise recursively in some of the following steps, this 
condition must be checked.) If not, the answer to the question is 'no'. 

(4) If the isogeny class is maximal (that is, if N is equal to the Weil bound 
for genus-(? curves over F^), the procedure checks whether the results of 
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Korchmaros and Torres [18] forbid the existence of a curve with Jacobian 
in the isogeny class. If so, the answer to the question is 'no'. 

(5) The procedure checks whether the isogeny class factors as an ordinary 
isogeny class times the class of a power of a supersingular elliptic curve 
with all endomorphisms defined. If so, it checks to see whether Theo- 
rem 13. II shows that the isogeny class does not contain a Jacobian. If so, the 
answer to the question is 'no'. 

(6) The procedure uses Theorem 15.21 to check whether the isogeny class can 
be descended to an isogeny class over a subfield. If so, the procedure uses 
Theorem 15.31 to recurse, and checks whether the associated isogeny classes 
over the subfield contain Jacobians. If they do not, then the answer to the 
question is 'no'. 

(7) The procedure checks whether the real Weil polynomial can be split into 
two factors whose resultant is 1. A result of Serre (see [TH Thm. 1(a), 
p. 1678]) says that no Jacobian can lie in such a class, so if there is such a 
splitting, the answer to the question is 'no'. 

(8) Using Proposition 12. 81 the procedure checks whether the real Weil polyno- 
mial can be split into two factors whose gluing exponent is 2. In this case, 
any curve whose Jacobian lies in the isogeny class must have an involution 
(Theorem 12.21) , and so must be a double cover of a curve D whose real 
Weil polynomial g can be determined up to at most two possibilities. If a 
contradiction can be deduced from this, either using Lemma 16.11 (below) 
or by showing recursively that there is no curve with real Weil polynomial 
equal to g, the answer to the question is 'no'. 

(9) The procedure checks to see whether Proposition 231 or a refinement using 
our tables of maximal lengths of short vectors of Hermitian forms, can 
be used to deduce the existence of a map of known degree n from any 
curve C with real Weil polynomial / to an elliptic curve E with a known 
trace. If such a map can be shown to exist, and if its existence leads to 
a contradiction (either by using Lemma 16.11 if n = 2, or by noting that 
#C(Fq) > n^E{Fq)), the answer to the question is 'no'. 

(10) If at this point the question has not yet been answered, the answer defaults 
to 'maybe', because we have no proof that the answer is 'no', and we do 
not know that the answer is 'yes'. 

To decide whether there is a problem with there being a double cover from a 
curve C whose Jacobian lies in an isogeny class Ci to a curve D whose Jacobian 
lies in an isogeny class C2, we use the following lemma: 

Lemma 6.1. SupposeC and D are curves overFq of genus gc and go, respectively, 
and for each i let ai and 6,; denote the number of places of degree i on C and on D, 
respectively. Suppose ip:C ^ D is a map of degree 2 . Let r denote the number of 
geometric points of D that ramify in the double cover, and let ri denote the number 
of Fq-rational points of D that ramify in the double cover. 

(1) We have 2bi — 2a2 — ai < ri < 2bi — ai. 

(2) We have ri = ai mod 2 and ri > 0. 

(3) We have r > n + J2i<d<gc,d odd,a, odd d- 

(4) If q is even, then r = 2-rankC — 2(2-rank_D) + 1 and r < gc ~ igjj + 1. 

(5) If q is odd, then r = 2gc — '^go + 2. 
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Proof. Let si and ii be the number of rational points of D that spUt and are inert 
(respectively) in ip. Then we have 

bi — si + ii + ri, ai = 2si + ri, and a2 > ii- 

These relations lead to statements (1) and (2). 

If d is odd, then the number of degree-d places on C is equal to twice the number 
of splitting degree-c? places on D, plus the number of ramifying degree-rf places on D. 
If d and ad are both odd, then there must be at least one degree-d place of D that 
ramifies. This leads to statement (3). 

If q is even, then the Deuring-Shafarevich formula and the Riemann-Hurwitz 
formula show that 

r = 2-rankC - 2(2-rankD) + 1 and r < gc - 2gD + 1, 

respectively. This is statement (4). If q is odd, then the Riemann-Hurwitz formula 
shows that r — 2gc — ^go + 2, which is (5). □ 

Lemma 16.11 gives a simple way of testing whether there is a problem with the 
existence of a degree-2 map C — > £>, where Jac C and Jac D lie in known isogeny 
classes. If we find contradictory statements about r and ri, we know there is 
a problem with there being such a double cover. We note that in the Magma 
routines from our earlier paper, we did not make use of all of the inequalities listed 
in Lemma 16.11 so this is another place where the new program improves upon the 
old. 

Finally, in some circumstances we can deduce that a curve with N points must 
be a degree-n cover of an elliptic curve for some n > 2. This will lead to a 
contradiction if > n#E{Fq). 

Using these criteria, the procedure process_isogeny_class decides whether it 
can deduce a contradiction from the existence of a Jacobian in a given isogeny class. 

7. New results and applications 

Our new program improved the best known upper bound on Nq{g) for more 
than 16% of the {q, g)-pa,irs in the 2009 version of the tables of van der Geer and 
van der Vlugt; this improvement is in addition to the improvements that came 
from our earlier paper. In this section we present a sample of some of these new 
results to indicate how the theorems from earlier in the paper come into play. 
We also give some examples that show that the information obtained from our 
program, combined with further analysis, can be used to restrict the possible Weil 
polynomials of curves with a given number of points. 

7.1. Proof that A'9(12) < 61. Consider the case q = 9 and g = 12. The Ihara 
bound says that iV9(12) < 63, and the Magma program we wrote for our earlier 
paper [lAi showed that in fact A'9(12) < 62. Our new program shows that iV9(12) < 
61; in this subsection we explain how our new techniques eliminate cases that our 
old techniques could not. 

Our old program could show that if a genus-12 curve over Fg has 62 points, then 
its real Weil polynomial is either 

{x + 2){x + Af{x + b)^{x + 6) or {x + {x + 6)'^ {x'^ + 8x + U) . 

Here is how our new program shows that the first of these polynomials is not the 
real Weil polynomial of a curve. 
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Let E be the unique elliptic curve over Fg with 15 points, so that E has trace 
—5. Using the gluing exponent, or even just using the resultant, one can show 
that if A is a principally polarized abelian variety with real Weil polynomial equal 
to {x + 2){x + 4)^(x + 5)'*(x + 6), then the principal polarization of A pulls back 
to a polarization of of degree 1 or degree 3^. Using Table [5] we find that this 
polarization of E* pulls back to give a polarization of degree at most 3^ on E, and 
Lemma 14.31 shows that if A is the Jacobian of a curve C, then C has a map of 
degree at most 3 to E. But then C could only have at most 3 times the number 
of rational points that E has, so that #C(Fg) < 45, and in particular C does not 
have 62 points. This eliminates the first of the two polynomials above. 

We turn now to the second polynomial. The smallest resultant that we can 
obtain between two complementary factors of the radical of the second real Weil 
polynomial is 4, and in fact we get this resultant from each of the three possible 
splittings. However, the reduced resultant of {x + 4)(a:: + 6) and (x^ + 8x + 14) 
is 2, so using Theorem l2.2l we find that a genus-12 curve C with the given real Weil 
polynomial must be a double cover of a genus-2 curve D with real Weil polynomial 
equal to x"^ + 8x + 14. From its real Weil polynomial we see that the curve D has 
only 18 rational points, so a double cover of D can have at most 36 rational points. 
This eliminates the second real Weil polynomial, and shows that Ng{12) < 61. □ 

The best lower bound on iV9(12) that we know at this time is 56, as shown by 
Gebhardt ffl Tbl. 2, p. 96], so there is still a gap between our current lower and 
upper bounds. 

7.2. New values of Nq{g). Running our new program, we find that N4{7) < 21 
and A^8(5) < 29. Niederreiter and Xing [31^ showed that there is a genus-7 curve 
over F4 with 21 points, and van der Geer and van der Vlugt [9] showed that there is 
a genus-5 curve over Fg with 29 points, so we see that A^4(7) = 21 and A^8(5) = 29. 

Let us sketch how our new program was able to improve upon the earlier program 
to show that iV4(7) < 21. The earlier program showed that any genus-7 curve over 
F4 with 22 points must have one of the following five real Weil polynomials: 

x(x + 2f{x + 3f{x + 4), 

{x + 3f{x* + 8x^ + 20x^ + 16x + 1), 

{x + l){x + 3)\x^ + 4x+l), 

(x + l){x + 3f{x + A){x^ +3x + 1), 

{x + 2f{x + A)^{x^ + 3x + 1). 

Our new program eliminates these possibilities. The first real Weil polynomial is 
forbidden by an argument on Hermitian forms. The second and fifth are eliminated 
by Theorem l2.2( b): one can show that curves with these real Weil polynomials must 
be double covers of other curves, and we obtain contradictions from Lemma 16.11 
The third is eliminated for the same reason; however, for this polynomial we need 
to use the gluing exponent and not just the resultant in order to show that the 
curve is a double cover. And finally, the fourth polynomial can be eliminated by 
using the supersingular factor method from Section O 

7.3. Correcting an error. In ^14j §7] we attempted to show two particular poly- 
nomials could not occur as real Weil polynomials of curves, but we made an error. 
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as is documented in the Corrigendum to ^Hj. We sketched corrected arguments in 
the second appendix of the arXiv version of [14]; here we provide ah the details. 
First, we would like to show that 

f ^{x + 2f{x + 3)(x^ + + a; - 3) 

cannot be the real Weil polynomial of a genus-6 curve C over F3. Using Proposi- 
tion 14.11 and Table S] we find that any curve with real Weil polynomial equal to / 
must be a double cover of the unique elliptic curve E over F3 with trace —2. But 
E has 6 rational points, so a double cover of E can have at most 12 points. Since 
C is supposed to have 15 points, we see that no such curve C can exist. Our new 
program makes these deductions automatically. 

The other argument in [141 §7] that we must correct concerns genus-4 curves 
over F27; we would like to show that no such curve can have 65 points. Our new 
program shows that if there were a genus-4 curve over F27 with 65 points, it would 
have to be a double cover of the unique elliptic curve E over F27 having 38 points. 
It is not hard to enumerate all of the genus-4 double covers of this elliptic curve; 
Magma code for doing so can be found on the first author's web site, in the section 
associated to the paper [T3]. The largest number of points we find on genus-4 
double cover of E is 64. 

7.4. Proof that Af32(4) < 72. In our earlier paper [rS, §6.2] we showed that 
-^32(4) < 75. Our new program shows that any genus-4 curve over F32 having 
more than 72 points must be a double cover of the unique elliptic curve with trace 
— 11. Enumerating the genus-4 double covers of this curve is a feasible computa- 
tional problem which can be solved by a simple modification of the method outlined 
in [141 §6.2] (in general we must consider three possible arrangements of ramification 
points, but in the specific situation we faced in [TU §6.2] we could eliminate one of 
these arrangements). We have implemented an algorithm to enumerate these double 
covers in Magma, and the resulting program can be found in the file 32-4 .magma, 
available at the URL mentioned in the Introduction. We find that no such double 
cover has more than 71 points, so Af32(4) < 72. This fact, combined with infor- 
mation gleaned from IsogenyClasses .magma, shows that a genus-4 curve over F32 
having 72 points must have real Weil polynomial equal to {x + ll)'^(a;^ -I- 17a; -I- 71). 

In 1999 Mike Zieve found a genus-4 curve over F32 with 71 points, and while 
searching for double covers of the trace —11 curve we also found a number of curves 
with 71 points. For example, if r € F32 satisfies + r'^ + 1 = 0, then the genus-4 
curve 

2 s 

y + xy = X + X 

z = {r^^x^ +r^^x + r^^)/{x + r) 
has 71 points. Thus, 71 < iV32(4) < 72. 

7.5. Genus 12 curves over F2. The smallest genus g for which the exact value 
of N2{g) is unknown is g — 12; the Oesterle bound is 15, and a genus-12 curve 
with 14 points is known. Our program, plus some additional work, allows us to 
show that a genus-12 curve over F2 with 15 points must have one of three real Weil 
polynomials. 

Theorem 7.1. If C is a genus-12 curve over F2 with 15 rational points, then the 
real Weil polynomial of C is equal to one of the following polynomials: 
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I. (x + lf{x + 2)2(a;2 _ 2)(a;2 +2x~ 2f 

II. (x - l)(x + 2f(x^ + 2x^ - - 2){x^ + _ g^^^jS + 4a;2 + g^. _ i) 

III. (x^ + a; - 3)(a;^ + S-x^ - 3)(.x^ + 4^^ + 3.x - l)(x'' + Ax'^ + 2x2 _ 5^; _ 3) 

Proof. Our program shows that the real Weil polynomial of such a curve is either 
one of the three listed in the theorem, or one of the following two: 

IV. (x2 + X - lf{x^ + 5x3 ^ 4^,2 _ ;^Q^ _ + 5a;3 ^ 5^2 _ 53, _ 5) 

V. (x^ + 3x2 _ 3) (^4 5^3 5^2 _ 5^ _ 5) (2.5 _^ 4^,4 ^ ^3 _ _ _^ 3) 

So to prove the theorem, all we must do is show that possibilities (IV) and (V) 
cannot occur. First we analyze possibility (IV). 
Let 

hi — x^ + X — 1 

/i2 = x"* + 5x3 ^ 4^2 _ -^Q^ 

/i3 = x"* + 5x3 + 52)2 - 5a; - 5 

be the irreducible factors of the real Weil polynomial h listed as item (IV). Since 
the constant terms of these polynomials are odd, they correspond to isogeny classes 
of ordinary abelian varieties. The corresponding Weil polynomials are 

/i = x^ + x3 + 3x2 + 2x + 4 

/2 = x^ + 5x^ + 12x'^ + 20x5 + 29x'' + 40x3 + 48x2 + 40x + 16 
/a = x^ + 5x^ + ISx'^ + 25x5 + 39x'' + 50x3 ^ ^2x2 + 40x + 16. 

Let ifi, K2, and be the CM fields defined by these three Weil polynomials, and 
for each i let tt^ be a root of fi in Ki. For each i we use Magma to check that 
Ki has class number 1, and we compute the discriminant of the maximal order Oi 
of Ki. Using jT2j Prop. 9.4, p. 2384] we find that for each i, the discriminant of the 
subring Ri := Z[7ri, Tf^] of Oi is equal to the discriminant of O^, so we have Ri — Oi. 
Using the theory of Deligne modules [T^] , we find for each i the isogeny class with 
real Weil polynomial hi contains a unique abelian variety Ai. 

Suppose there were a curve C with real Weil polynomial equal to h\h2h3. Factor- 
ing this real Weil polynomial as h\h2 times /13, noting that the reduced resultant of 
/11/12 and /i3 is 3, and applying Lemma l2.31 we find that we have an exact sequence 

^ A ^ B X A3 ^ Jac C ^ 0, 

where B is isogenous to A\ x A2 and where A is a self-dual group scheme that can 
be embedded into both i?[3] and A3 [3]. 

Since the reduced resultant of hi and /12 is 19, there is an isogeny A\'x A2 ^ B 
whose degree is a power of 19; in particular, the group scheme i?[3] is isomorphic 

to Ai[3]2 X A2[i\. 

The group scheme structure of each Ai[Z] is determined by the _Ri-module struc- 
ture of Oi/'iOi (see [HI Lem. 4.13, p. 2372]). Since 3 is unramified in Ki and K2, we 
find that i?[3] is a direct sum of simple group schemes. However, A3 [3] is not semi- 
simple; the prime 3 is ramified in K^, and in fact in we have 3 = — C^(l ~ C)^j 
where 



( = -(98 + 69 7r3 + 40 7r| + 18 7r| -I- 5 tt^ + 56 ¥3 + 25 7f^ + iTfl) 
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is a cube root of unity. From this we see that the unique semi-simple subgroup- 
scheme of A3 [3] is the kernel of 1 — C, so the image of A under the projection from 
B X ^3 to A3 lies in A^ll - (]. 

Now consider the automorphism a :— (1,C) of S x A3. Clearly a acts trivially 
on _B X j43[1 — C], so it acts trivially on the image of A, and therefore it descends 
to give an automorphism /S (of order 3) on JacC. Furthermore, since CC = 1, the 
automorphism a respects the puUback to i? x A3 of the principal polarization of 
Jac C, so /3 is an automorphism of Jac C as a polarized variety. The strong form 
of Torelli's theorem [27l Thm. 12.1, p. 202] shows that C must therefore have an 
automorphism 7 of order 3. Let D be the quotient C/{'j), so that there is a degree-3 
Galois cover C ^ D. 

We calculate from its Weil polynomial that C has 41 places of degree 8. Since 
8 is not a multiple of 3, every degree-8 place of C lies over a degree-8 place of D, 
and since 41 is congruent to 2 mod 3, we see that at least 2 degree-8 places of D 
ramify in the triple cover C D. Thus, the degree of the different of the cover is 
at least 32. The Riemann-Hurwitz formula then gives 

22 = 2gc - 2 5{2gD - 2) + (degree of different) > 6gD + 26, 

so that the genus of D must be negative. This contradiction shows that no curve 
over F2 can have real Weil polynomial equal to possibility (IV) above. 

Next we consider the polynomial h from item (V) above. As in the preceding 
case, h corresponds to an ordinary isogeny class. We will use the results of [12] to 
show that there are no principally polarized abelian varieties in this isogeny class. 
Let us sketch what these results are and how they are used. 

A CM- order is a ring R that is isomorphic to an order in a product of CM 
fields and that is stable under complex conjugation. Section 5 of [12] defines a 
contravariant functor B from the category of CM-orders to the category of finite 
2-torsion groups. If C is an isogeny class of ordinary abelian varieties corresponding 
to a Weil polynomial /, then each irreducible factor fi of / defines a CM field Ki 
with maximal order Oi. Frobenius and Verschiebung generate an order R in the 
product K of the Ki. Section 5 of [12] uses properties of the polynomial fi to 
define an element li of B{Oi). The map R C Yi^i ~^ gives a homomorphism 
B{Oi) — > B{R), and we define Ic to be the sum of the images of the li in B{R). 
Theorem 5.6 (p. 2375) of [12] says that there is a principally polarized variety in C 
if and only if Jc =0. 

Proposition 10.1 (p. 2385) of [Ij] shows how to compute B{Oi), and Propo- 
sition 10.5 (p. 2387) shows how to compute B{R) and the map B{Oi) B{R). 
Proposition 11.3 (p. 2390) and Proposition 11.5 (pp. 2391-2392) show how to com- 
pute the elements It of B{Oi). We will apply these results to show that for the 
isogeny class C defined by the ordinary real Weil polynomial h in item (V), the 
element Ic is nonzero, so that there are no principally polarized varieties in C, and 
in particular no Jacobians. 

Let 

hi=x^ + 2,x^ - 3 

h2^x'^ + 5x^ + 5x^ - 5a; - 5 

/13 = + 4,x^ + - 9x^ - 5a; + 3 
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SO that h — hih2hz- The Weil polynomials corresponding to the hi are 

= + ix^ + Qx^ + 9a;3 + I2x'^ + 12j; + 8 

/2 = + Sx^ + lix^ + 25a;^ + Sgx" + 50a;^ + b2x^ + 40a; + 16 

h = + Ax^ + llx^ + 23x^ + 41a;^ + GSx^ + 82a;^ + 92a;^ + SBx^ + 64a; + 32. 

Let Ki, K2, and i^a be the CM fields defined by these three Weil polynomials, and 
for each i let tt^ be a root of fi in Ki. Let be the maximal order of Ki, and let R 
be the subring of O1XO2X O3 generated by tt := (tti, 7r2, tts) and W :— (tTi, 7f2, tTs). 

From [H Prop 10.1, p. 2385] we see that BiOi) ^ 6(03) ^ and ^(03) 
Z/2Z. According to [lY, Props. 11.3 and 11.5], the element I2 of 6(02) wih be 
zero if and only if the positive square root of Norm;^;2/Q(''''2 ~ ^^2) is congruent to 
the middle coefficient of /2 modulo 4. The norm of tt2 — tt2 is 1, and the middle 
coefficient of /2 is 39, so we find that /2 7^ 0. 

Let = d X O2 X O3. To calculate B{R) and the map i* : B{S) B{R) obtained 
from the inclusion i:R—i'S,we apply [HI Prop. 10.5, p. 2387]. That proposition 
shows that there is a push-out diagram 

Ds ^ B{S) 

N 

Cs B{R) 

where and Cs are certain finite 2-torsion groups. Let i?+ and S*^ be the subrings 
of R and S consisting of elements fixed by complex conjugation, so that = 
Oi X O2 X and i?+ = Z[7r + tF]. Then Cs has a basis (as an F2-vector space) 
consisting of elements indexed by the set 

{maximal ideals p of i?+ | p is singular and is inert in R/R'^} 

and Ds has a basis consisting of elements indexed by the set 

q is inert in S/S^, 
q n R^ is singular in i?+ , and 
q n i?+ is inert in R/R+ 

Let us compute the maximal ideals of i?+ that are singular and that are inert 
in R/R+. Since R+ Z[x]/{h) and R = R-^[x]/{x^ - (tt + W)x + q), this is a 
straightforward matter. We leave the details to the reader, but the only prime we 
find that is singular and inert is p = (3, tt + 7f). 

There are two maximal ideals of S'^ lying over p: the ideal qi = (3, tti +Tfi) of 
and the ideal qa — (3, tts + 713) of . We compute that qi splits in Oi and that qa 
splits in O3 . Therefore the group Dg is trivial. It follows from the push-out diagram 
that i* is injective, so i*{l2) is nonzero, and there is no principally-polarized variety 
in the isogeny class associated to h. □ 

8. Bounds on Shafarevich-Tate groups 

Propositions 12.51 and 14.11 both give upper bounds on the degrees of the smallest 
map from a curve C to an elliptic curve E, and therefore say something about 
the Mordell-Weil lattice of maps from C to E. The Birch and Swinnerton-Dyer 
conjecture for constant elliptic curves over one-dimensional function fields over finite 
fields, proven by Milne [26], relates the determinants of such Mordell-Weil lattices 



1 



maximal ideals q of 
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to certain Shafarevich-Tate groups. In this section we make some comparisons 
between our results and the conjecture of Birch and Swinnerton-Dyer, and deduce 
some results about Shafarevich-Tate groups. 

Let C be a curve over a finite field Fq of characteristic p, and let K be its 
function field. Suppose there is an embedding ip : E Jac C of an elliptic curve 
E into the Jacobian of C. Pick a degree-1 divisor X on C, and let (p : C E he 
the map associated to ip and X as in Lemma 14.31 The assumption that ip is an 
embedding implies that ip is minimal; that is, ip does not factor through an isogeny 
from another elliptic curve to E. (Conversely, a minimal map from C to an elliptic 
curve gives rise to an embedding of the elliptic curve into the Jacobian of C.) 

Suppose further that there is only one factor of E in the Jacobian of C, up to 
isogeny; that is, assume that Jac C is isogenous to A x E for an abelian variety 
A such that the gluing exponent e := e{A, E) is finite. Let h be the real Weil 
polynomial of A, let g be the radical of h, and let t be the trace of E. Note that 
Proposition 12.51 says that deg ip divides e, and that Proposition 12.81 says that e 
divides the reduced resultant of g with x — t, which is equal to g{t). 

Theorem 8.1. Let R be the endomorphism ring of E, let E be the base extension 
of E from Fq to K, and letHl be the Shafarevich-Tate group ofF. 

(a) Suppose R is an order in a quadratic field, so that we may write t^ ~ Aq = 
i^^ Ag for some fundamental discriminant Aq and conductor F , and so that 
the discriminant oflSndE is equal to /^Aq for some divisor f of F. Then 

F\h{t)\ 



and \/ #111 is divisible by 

F 
7 



/ degt/j' 
h{t) 



ait) ■ 

(b) Suppose R is an order in a quaternion algebra. Then q is a square, we have 

V^\Kt)\ 



P degp' 



and \/ ffUl is divisible by 



p 



h{t) 



Proof. Since every map from an elliptic curve isogenous to E to Jac C factors 
through the embedding : E ^ Jac C, it follows that any map from C to an 
elliptic curve isogenous to E factors through (p. In particular, the set L of maps 
from C to i? that take X to a divisor on E that sums to the identity is equal to Rp. 

The Mordell-Weil lattice of E over K is the group F{K)/E{Fq) provided with 
the pairing coming from the canonical height (see |39)). The natural map L — > 
F{K)/E{Fq) is a bijection, and the quadratic form on L obtained from the height 
pairing on F{K) is twice the quadratic form given by the degree map (see [iOl 
Thm. III.4.3, pp. 217-218]). 

Suppose that R is an order in a quadratic field. Using the fact that L — Rp, we 
find that the determinant D of the Mordell-Weil lattice for E satisfies 

D = {Aegpf |disci?| = (deg(^)V' |Ao| ■ 
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Let the eigenvalues of Frobenius for Jac C be 

TTl , 7fl , 7r2 , 7f2 , . . . , TTg, TTg, 

indexed so that tti and 7fi are the (distinct) eigenvalues of Frobenius for E. The 
Birch and Swinnerton-Dyer conjecture for constant elliptic curves over function 
fields 26, Thm. 3, pp. 100-101] says that the product D^UI is equal to 




Combining this with the relations TTiTr^ — q, and using the facts that tti + tti = t 
and (tti — tti)^ = F^Aq, we find that 



i>l 
i>l 

= F^\Ao\l[it-7r,-n,)^ 



i>i 



^F'\Ao\h'{t). 
Using the equation for D given above, we find that 



F h{t) 



As we noted earlier, deg(p is divisor of g{t). This proves statement (a). 

Suppose i? is a (necessarily maximal) order in a quaternion algebra. This implies 
that g is a square and the Frobenius eigenvalues of E are both equal to ^^q or 
to —^/q■ Again calculating the determinant D of the Mordell-Weil lattice of E by 
using the identification L — Rip, we find that D — (deg(^)^^)^; using [261 Thm. 3, 
pp. 100-101] we find that 

Di^UI = qh^it). 

From these equalities we obtain 

yq h{t) 



and as above we find that ^/^ffUl is a multiple of 

p git)' 



□ 



Our results tell us something about Shafarevich-Tate groups in other situations 
as well. Suppose C is a curve over a finite field whose Jacobian is isogenous 
to E^ , for some ordinary elliptic curve E over with trace t. Let R be the 
endomorphism ring of E. There is a universal isogeny : A — ^ Jac C, unique up to 
isomorphism, with the property that every map ip: E ^ JacC factors through 4'; 
the Deligne module for A is the largest submodule of the Deligne module for Jac C 
that is also an i?-module. 

Write P ~ Aq = F^Aq for a fundamental discriminant Aq and a conductor F, 
and let / be the conductor of EndE, so that / | F. 
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Theorem 8.2. Let K he the function field of C , let E be the base extension of E 
from Fq to K, and let ILL be the Shafarevich-Tate group o/E. Then 

V¥Bi={F/fydeg^. 

Proof. Let fi be the canonical principal polarization of Jac C, and let A be the 
pullback of /X to A via the isogeny ^. Consider the lattice of homomorphisms 
E — >■ Jac C, with the quadratic form Q provided by the square root of the degree 
of the pullback of /i to E. Since every homomorphism E — > Jac C factors through 
^, this lattice is isomorphic to to the lattice of homomorphisms E ^ A, with the 
quadratic form given by the square root of the degree of the pullback of A to E. 
Applying Lemma 14.21 '^^ see that the determinant of this lattice is 

|(disci?)/4|« (degMff - (//2)29 |Ao|^ (deg^f. 

As we have noted earlier, the Mordell-Weil lattice of E is isomorphic to the lat- 
tice of homomorphisms E —>■ JacC, with the quadratic form 2Q. Therefore the 
determinant D of the Mordell-Weil lattice is 

D = f'3\Aof{deg^f. 

On the other hand, the Birch and Swinnerton-Dyer conjecture says that in this case 
we have 

= (tt — 7r)^(7r — tt)^ 
= {4q-ty 

Thus we find that 

V#Ui= (F//)fdegvI/. □ 
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